|
Packit |
5ce601 |
|
|
Packit |
5ce601 |
- Copyright (C) Internet Systems Consortium, Inc. ("ISC")
|
|
Packit |
5ce601 |
-
|
|
Packit |
5ce601 |
- This Source Code Form is subject to the terms of the Mozilla Public
|
|
Packit |
5ce601 |
- License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
Packit Service |
704ed8 |
- file, you can obtain one at https://mozilla.org/MPL/2.0/.
|
|
Packit |
5ce601 |
-
|
|
Packit |
5ce601 |
- See the COPYRIGHT file distributed with this work for additional
|
|
Packit |
5ce601 |
- information regarding copyright ownership.
|
|
Packit |
5ce601 |
-->
|
|
Packit |
5ce601 |
### Functional enhancements from prior major releases of BIND 9
|
|
Packit |
5ce601 |
|
|
Packit |
5ce601 |
#### BIND 9.10.0
|
|
Packit |
5ce601 |
|
|
Packit |
5ce601 |
BIND 9.10.0 includes a number of changes from BIND 9.9 and earlier
|
|
Packit |
5ce601 |
releases. New features include:
|
|
Packit |
5ce601 |
|
|
Packit |
5ce601 |
- DNS Response-rate limiting (DNS RRL), which blunts the
|
|
Packit |
5ce601 |
impact of reflection and amplification attacks, is always
|
|
Packit |
5ce601 |
compiled in and no longer requires a compile-time option
|
|
Packit |
5ce601 |
to enable it.
|
|
Packit |
5ce601 |
- An experimental "Source Identity Token" (SIT) EDNS option
|
|
Packit |
5ce601 |
is now available. Similar to DNS Cookies as invented by
|
|
Packit |
5ce601 |
Donald Eastlake 3rd, these are designed to enable clients
|
|
Packit |
5ce601 |
to detect off-path spoofed responses, and to enable servers
|
|
Packit |
5ce601 |
to detect spoofed-source queries. Servers can be configured
|
|
Packit |
5ce601 |
to send smaller responses to clients that have not identified
|
|
Packit |
5ce601 |
themselves using a SIT option, reducing the effectiveness of
|
|
Packit |
5ce601 |
amplification attacks. RRL processing has also been updated;
|
|
Packit |
5ce601 |
clients proven to be legitimate via SIT are not subject to
|
|
Packit |
5ce601 |
rate limiting. Use "configure --enable-sit" to enable this
|
|
Packit |
5ce601 |
feature in BIND.
|
|
Packit |
5ce601 |
- A new zone file format, "map", stores zone data in a
|
|
Packit |
5ce601 |
format that can be mapped directly into memory, allowing
|
|
Packit |
5ce601 |
significantly faster zone loading.
|
|
Packit |
5ce601 |
- "delv" (domain entity lookup and validation) is a new tool
|
|
Packit |
5ce601 |
with dig-like semantics for looking up DNS data and performing
|
|
Packit |
5ce601 |
internal DNSSEC validation. This allows easy validation in
|
|
Packit |
5ce601 |
environments where the resolver may not be trustworthy, and
|
|
Packit |
5ce601 |
assists with troubleshooting of DNSSEC problems. (NOTE:
|
|
Packit |
5ce601 |
In previous development releases of BIND 9.10, this utility
|
|
Packit |
5ce601 |
was called "delve". The spelling has been changed to avoid
|
|
Packit |
5ce601 |
confusion with the "delve" utility included with the Xapian
|
|
Packit |
5ce601 |
search engine.)
|
|
Packit |
5ce601 |
- Improved EDNS(0) processing for better resolver performance
|
|
Packit |
5ce601 |
and reliability over slow or lossy connections.
|
|
Packit |
5ce601 |
- A new "configure --with-tuning=large" option tunes certain
|
|
Packit |
5ce601 |
compiled-in constants and default settings to values better
|
|
Packit |
5ce601 |
suited to large servers with abundant memory. This can
|
|
Packit |
5ce601 |
improve performance on such servers, but will consume more
|
|
Packit |
5ce601 |
memory and may degrade performance on smaller systems.
|
|
Packit |
5ce601 |
- Substantial improvement in response-policy zone (RPZ)
|
|
Packit |
5ce601 |
performance. Up to 32 response-policy zones can be
|
|
Packit |
5ce601 |
configured with minimal performance loss.
|
|
Packit |
5ce601 |
- To improve recursive resolver performance, cache records
|
|
Packit |
5ce601 |
which are still being requested by clients can now be
|
|
Packit |
5ce601 |
automatically refreshed from the authoritative server
|
|
Packit |
5ce601 |
before they expire, reducing or eliminating the time
|
|
Packit |
5ce601 |
window in which no answer is available in the cache.
|
|
Packit |
5ce601 |
- New "rpz-client-ip" triggers and drop policies allowing
|
|
Packit |
5ce601 |
response policies based on the IP address of the client.
|
|
Packit |
5ce601 |
- ACLs can now be specified based on geographic location
|
|
Packit |
5ce601 |
using the MaxMind GeoIP databases. Use "configure
|
|
Packit |
5ce601 |
--with-geoip" to enable.
|
|
Packit |
5ce601 |
- Zone data can now be shared between views, allowing
|
|
Packit |
5ce601 |
multiple views to serve the same zones authoritatively
|
|
Packit |
5ce601 |
without storing multiple copies in memory.
|
|
Packit |
5ce601 |
- New XML schema (version 3) for the statistics channel
|
|
Packit |
5ce601 |
includes many new statistics and uses a flattened XML tree
|
|
Packit |
5ce601 |
for faster parsing. The older schema is now deprecated.
|
|
Packit |
5ce601 |
- A new stylesheet, based on the Google Charts API, displays
|
|
Packit |
5ce601 |
XML statistics in charts and graphs on javascript-enabled
|
|
Packit |
5ce601 |
browsers.
|
|
Packit |
5ce601 |
- The statistics channel can now provide data in JSON
|
|
Packit |
5ce601 |
format as well as XML.
|
|
Packit |
5ce601 |
- New stats counters track TCP and UDP queries received
|
|
Packit |
5ce601 |
per zone, and EDNS options received in total.
|
|
Packit |
5ce601 |
- The internal and export versions of the BIND libraries
|
|
Packit |
5ce601 |
(libisc, libdns, etc) have been unified so that external
|
|
Packit |
5ce601 |
library clients can use the same libraries as BIND itself.
|
|
Packit |
5ce601 |
- A new compile-time option, "configure --enable-native-pkcs11",
|
|
Packit |
5ce601 |
allows BIND 9 cryptography functions to use the PKCS#11 API
|
|
Packit |
5ce601 |
natively, so that BIND can drive a cryptographic hardware
|
|
Packit |
5ce601 |
service module (HSM) directly instead of using a modified
|
|
Packit |
5ce601 |
OpenSSL as an intermediary. (Note: This feature requires an
|
|
Packit |
5ce601 |
HSM to have a full implementation of the PKCS#11 API; many
|
|
Packit |
5ce601 |
current HSMs only have partial implementations. The new
|
|
Packit |
5ce601 |
"pkcs11-tokens" command can be used to check API completeness.
|
|
Packit |
5ce601 |
Native PKCS#11 is known to work with the Thales nShield HSM
|
|
Packit |
5ce601 |
and with SoftHSM version 2 from the Open DNSSEC project.)
|
|
Packit |
5ce601 |
- The new "max-zone-ttl" option enforces maximum TTLs for
|
|
Packit |
5ce601 |
zones. This can simplify the process of rolling DNSSEC keys
|
|
Packit |
5ce601 |
by guaranteeing that cached signatures will have expired
|
|
Packit |
5ce601 |
within the specified amount of time.
|
|
Packit |
5ce601 |
- "dig +subnet" sends an EDNS CLIENT-SUBNET option when
|
|
Packit |
5ce601 |
querying.
|
|
Packit |
5ce601 |
- "dig +expire" sends an EDNS EXPIRE option when querying.
|
|
Packit |
5ce601 |
When this option is sent with an SOA query to a server
|
|
Packit |
5ce601 |
that supports it, it will report the expiry time of
|
|
Packit |
5ce601 |
a slave zone.
|
|
Packit |
5ce601 |
- New "dnssec-coverage" tool to check DNSSEC key coverage
|
|
Packit |
5ce601 |
for a zone and report if a lapse in signing coverage has
|
|
Packit |
5ce601 |
been inadvertently scheduled.
|
|
Packit |
5ce601 |
- Signing algorithm flexibility and other improvements
|
|
Packit |
5ce601 |
for the "rndc" control channel.
|
|
Packit |
5ce601 |
- "named-checkzone" and "named-compilezone" can now read
|
|
Packit |
5ce601 |
journal files, allowing them to process dynamic zones.
|
|
Packit |
5ce601 |
- Multiple DLZ databases can now be configured. Individual
|
|
Packit |
5ce601 |
zones can be configured to be served from a specific DLZ
|
|
Packit |
5ce601 |
database. DLZ databases now serve zones of type "master"
|
|
Packit |
5ce601 |
and "redirect".
|
|
Packit |
5ce601 |
- "rndc zonestatus" reports information about a specified zone.
|
|
Packit |
5ce601 |
- "named" now listens on IPv6 as well as IPv4 interfaces
|
|
Packit |
5ce601 |
by default.
|
|
Packit |
5ce601 |
- "named" now preserves the capitalization of names
|
|
Packit |
5ce601 |
when responding to queries: for instance, a query for
|
|
Packit |
5ce601 |
"example.com" may be answered with "example.COM" if the
|
|
Packit |
5ce601 |
name was configured that way in the zone file. Some
|
|
Packit |
5ce601 |
clients have a bug causing them to depend on the older
|
|
Packit |
5ce601 |
behavior, in which the case of the answer always matched
|
|
Packit |
5ce601 |
the case of the query, rather than the case of the name
|
|
Packit |
5ce601 |
configured in the DNS. Such clients can now be specified
|
|
Packit |
5ce601 |
in the new "no-case-compress" ACL; this will restore the
|
|
Packit |
5ce601 |
older behavior of "named" for those clients only.
|
|
Packit |
5ce601 |
- new "dnssec-importkey" command allows the use of offline
|
|
Packit |
5ce601 |
DNSSEC keys with automatic DNSKEY management.
|
|
Packit |
5ce601 |
- New "named-rrchecker" tool to verify the syntactic
|
|
Packit |
5ce601 |
correctness of individual resource records.
|
|
Packit |
5ce601 |
- When re-signing a zone, the new "dnssec-signzone -Q" option
|
|
Packit |
5ce601 |
drops signatures from keys that are still published but are
|
|
Packit |
5ce601 |
no longer active.
|
|
Packit |
5ce601 |
- "named-checkconf -px" will print the contents of configuration
|
|
Packit |
5ce601 |
files with the shared secrets obscured, making it easier to
|
|
Packit |
5ce601 |
share configuration (e.g. when submitting a bug report)
|
|
Packit |
5ce601 |
without revealing private information.
|
|
Packit |
5ce601 |
- "rndc scan" causes named to re-scan network interfaces for
|
|
Packit |
5ce601 |
changes in local addresses.
|
|
Packit |
5ce601 |
- On operating systems with support for routing sockets,
|
|
Packit |
5ce601 |
network interfaces are re-scanned automatically whenever
|
|
Packit |
5ce601 |
they change.
|
|
Packit |
5ce601 |
- "tsig-keygen" is now available as an alternate command
|
|
Packit |
5ce601 |
name to use for "ddns-confgen".
|
|
Packit |
5ce601 |
|
|
Packit |
5ce601 |
#### BIND 9.9.0
|
|
Packit |
5ce601 |
|
|
Packit |
5ce601 |
BIND 9.9.0 includes a number of changes from BIND 9.8 and earlier
|
|
Packit |
5ce601 |
releases. New features include:
|
|
Packit |
5ce601 |
|
|
Packit |
5ce601 |
- Inline signing, allowing automatic DNSSEC signing of
|
|
Packit |
5ce601 |
master zones without modification of the zonefile, or
|
|
Packit |
5ce601 |
"bump in the wire" signing in slaves.
|
|
Packit |
5ce601 |
- NXDOMAIN redirection.
|
|
Packit |
5ce601 |
- New 'rndc flushtree' command clears all data under a given
|
|
Packit |
5ce601 |
name from the DNS cache.
|
|
Packit |
5ce601 |
- New 'rndc sync' command dumps pending changes in a dynamic
|
|
Packit |
5ce601 |
zone to disk without a freeze/thaw cycle.
|
|
Packit |
5ce601 |
- New 'rndc signing' command displays or clears signing status
|
|
Packit |
5ce601 |
records in 'auto-dnssec' zones.
|
|
Packit |
5ce601 |
- NSEC3 parameters for 'auto-dnssec' zones can now be set prior
|
|
Packit |
5ce601 |
to signing, eliminating the need to initially sign with NSEC.
|
|
Packit |
5ce601 |
- Startup time improvements on large authoritative servers.
|
|
Packit |
5ce601 |
- Slave zones are now saved in raw format by default.
|
|
Packit |
5ce601 |
- Several improvements to response policy zones (RPZ).
|
|
Packit |
5ce601 |
- Improved hardware scalability by using multiple threads
|
|
Packit |
5ce601 |
to listen for queries and using finer-grained client locking
|
|
Packit |
5ce601 |
- The 'also-notify' option now takes the same syntax as
|
|
Packit |
5ce601 |
'masters', so it can used named masterlists and TSIG keys.
|
|
Packit |
5ce601 |
- 'dnssec-signzone -D' writes an output file containing only DNSSEC
|
|
Packit |
5ce601 |
data, which can be included by the primary zone file.
|
|
Packit |
5ce601 |
- 'dnssec-signzone -R' forces removal of signatures that are
|
|
Packit |
5ce601 |
not expired but were created by a key which no longer exists.
|
|
Packit |
5ce601 |
- 'dnssec-signzone -X' allows a separate expiration date to
|
|
Packit |
5ce601 |
be specified for DNSKEY signatures from other signatures.
|
|
Packit |
5ce601 |
- New '-L' option to dnssec-keygen, dnssec-settime, and
|
|
Packit |
5ce601 |
dnssec-keyfromlabel sets the default TTL for the key.
|
|
Packit |
5ce601 |
- dnssec-dsfromkey now supports reading from standard input,
|
|
Packit |
5ce601 |
to make it easier to convert DNSKEY to DS.
|
|
Packit |
5ce601 |
- RFC 1918 reverse zones have been added to the empty-zones
|
|
Packit |
5ce601 |
table per RFC 6303.
|
|
Packit |
5ce601 |
- Dynamic updates can now optionally set the zone's SOA serial
|
|
Packit |
5ce601 |
number to the current UNIX time.
|
|
Packit |
5ce601 |
- DLZ modules can now retrieve the source IP address of
|
|
Packit |
5ce601 |
the querying client.
|
|
Packit |
5ce601 |
- 'request-ixfr' option can now be set at the per-zone level.
|
|
Packit |
5ce601 |
- 'dig +rrcomments' turns on comments about DNSKEY records,
|
|
Packit |
5ce601 |
indicating their key ID, algorithm and function
|
|
Packit |
5ce601 |
- Simplified nsupdate syntax and added readline support
|
|
Packit |
5ce601 |
|
|
Packit |
5ce601 |
#### BIND 9.8.0
|
|
Packit |
5ce601 |
|
|
Packit |
5ce601 |
BIND 9.8.0 includes a number of changes from BIND 9.7 and earlier
|
|
Packit |
5ce601 |
releases. New features include:
|
|
Packit |
5ce601 |
|
|
Packit |
5ce601 |
- Built-in trust anchor for the root zone, which can be
|
|
Packit |
5ce601 |
switched on via "dnssec-validation auto;"
|
|
Packit |
5ce601 |
- Support for DNS64.
|
|
Packit |
5ce601 |
- Support for response policy zones (RPZ).
|
|
Packit |
5ce601 |
- Support for writable DLZ zones.
|
|
Packit |
5ce601 |
- Improved ease of configuration of GSS/TSIG for
|
|
Packit |
5ce601 |
interoperability with Active Directory
|
|
Packit |
5ce601 |
- Support for GOST signing algorithm for DNSSEC.
|
|
Packit |
5ce601 |
- Removed RTT Banding from server selection algorithm.
|
|
Packit |
5ce601 |
- New "static-stub" zone type.
|
|
Packit |
5ce601 |
- Allow configuration of resolver timeouts via
|
|
Packit |
5ce601 |
"resolver-query-timeout" option.
|
|
Packit |
5ce601 |
- The DLZ "dlopen" driver is now built by default.
|
|
Packit |
5ce601 |
- Added a new include file with function typedefs
|
|
Packit |
5ce601 |
for the DLZ "dlopen" driver.
|
|
Packit |
5ce601 |
- Made "--with-gssapi" default.
|
|
Packit |
5ce601 |
- More verbose error reporting from DLZ LDAP.
|
|
Packit |
5ce601 |
|
|
Packit |
5ce601 |
#### BIND 9.7.0
|
|
Packit |
5ce601 |
|
|
Packit |
5ce601 |
BIND 9.7.0 includes a number of changes from BIND 9.6 and earlier
|
|
Packit |
5ce601 |
releases. Most are intended to simplify DNSSEC configuration.
|
|
Packit |
5ce601 |
New features include:
|
|
Packit |
5ce601 |
|
|
Packit |
5ce601 |
- Fully automatic signing of zones by "named".
|
|
Packit |
5ce601 |
- Simplified configuration of DNSSEC Lookaside Validation (DLV).
|
|
Packit |
5ce601 |
- Simplified configuration of Dynamic DNS, using the "ddns-confgen"
|
|
Packit |
5ce601 |
command line tool or the "local" update-policy option. (As a side
|
|
Packit |
5ce601 |
effect, this also makes it easier to configure automatic zone
|
|
Packit |
5ce601 |
re-signing.)
|
|
Packit |
5ce601 |
- New named option "attach-cache" that allows multiple views to
|
|
Packit |
5ce601 |
share a single cache.
|
|
Packit |
5ce601 |
- DNS rebinding attack prevention.
|
|
Packit |
5ce601 |
- New default values for dnssec-keygen parameters.
|
|
Packit |
5ce601 |
- Support for RFC 5011 automated trust anchor maintenance
|
|
Packit |
5ce601 |
- Smart signing: simplified tools for zone signing and key
|
|
Packit |
5ce601 |
maintenance.
|
|
Packit |
5ce601 |
- The "statistics-channels" option is now available on Windows.
|
|
Packit |
5ce601 |
- A new DNSSEC-aware libdns API for use by non-BIND9 applications
|
|
Packit |
5ce601 |
- On some platforms, named and other binaries can now print out
|
|
Packit |
5ce601 |
a stack backtrace on assertion failure, to aid in debugging.
|
|
Packit |
5ce601 |
- A "tools only" installation mode on Windows, which only installs
|
|
Packit |
5ce601 |
dig, host, nslookup and nsupdate.
|
|
Packit |
5ce601 |
- Improved PKCS#11 support, including Keyper support and explicit
|
|
Packit |
5ce601 |
OpenSSL engine selection.
|
|
Packit |
5ce601 |
|
|
Packit |
5ce601 |
#### BIND 9.6.0
|
|
Packit |
5ce601 |
|
|
Packit |
5ce601 |
- Full NSEC3 support
|
|
Packit |
5ce601 |
- Automatic zone re-signing
|
|
Packit |
5ce601 |
- New update-policy methods tcp-self and 6to4-self
|
|
Packit |
5ce601 |
- The BIND 8 resolver library, libbind, has been removed from the BIND 9
|
|
Packit |
5ce601 |
distribution and is now available as a separate download.
|
|
Packit |
5ce601 |
- Change the default pid file location from /var/run to
|
|
Packit |
5ce601 |
/var/run/{named,lwresd} for improved chroot/setuid support.
|
|
Packit |
5ce601 |
|
|
Packit |
5ce601 |
#### BIND 9.5.0
|
|
Packit |
5ce601 |
|
|
Packit |
5ce601 |
- GSS-TSIG support (RFC 3645).
|
|
Packit |
5ce601 |
- DHCID support.
|
|
Packit |
5ce601 |
- Experimental http server and statistics support for named via xml.
|
|
Packit |
5ce601 |
- More detailed statistics counters including those supported in BIND 8.
|
|
Packit |
5ce601 |
- Faster ACL processing.
|
|
Packit |
5ce601 |
- Use Doxygen to generate internal documentation.
|
|
Packit |
5ce601 |
- Efficient LRU cache-cleaning mechanism.
|
|
Packit |
5ce601 |
- NSID support.
|
|
Packit |
5ce601 |
|
|
Packit |
5ce601 |
BIND 9.4.0
|
|
Packit |
5ce601 |
|
|
Packit |
5ce601 |
- Implemented "additional section caching (or acache)", an internal cache
|
|
Packit |
5ce601 |
framework for additional section content to improve response performance.
|
|
Packit |
5ce601 |
Several configuration options were provided to control the behavior.
|
|
Packit |
5ce601 |
- New notify type 'master-only'. Enable notify for master zones only.
|
|
Packit |
5ce601 |
- Accept 'notify-source' style syntax for query-source.
|
|
Packit |
5ce601 |
- rndc now allows addresses to be set in the server clauses.
|
|
Packit |
5ce601 |
- New option "allow-query-cache". This lets "allow-query" be used to
|
|
Packit |
5ce601 |
specify the default zone access level rather than having to have every
|
|
Packit |
5ce601 |
zone override the global value. "allow-query-cache" can be set at both
|
|
Packit |
5ce601 |
the options and view levels. If "allow-query-cache" is not set then
|
|
Packit |
5ce601 |
"allow-recursion" is used if set, otherwise "allow-query" is used if set
|
|
Packit |
5ce601 |
unless "recursion no;" is set in which case "none;" is used, otherwise
|
|
Packit |
5ce601 |
the default (localhost; localnets;) is used.
|
|
Packit |
5ce601 |
- rndc: the source address can now be specified.
|
|
Packit |
5ce601 |
- ixfr-from-differences now takes master and slave in addition to yes and
|
|
Packit |
5ce601 |
no at the options and view levels.
|
|
Packit |
5ce601 |
- Allow the journal's name to be changed via named.conf.
|
|
Packit |
5ce601 |
- 'rndc notify zone [class [view]]' resend the NOTIFY messages for the
|
|
Packit |
5ce601 |
specified zone.
|
|
Packit |
5ce601 |
- 'dig +trace' now randomly selects the next servers to try. Report if
|
|
Packit |
5ce601 |
there is a bad delegation.
|
|
Packit |
5ce601 |
- Improve check-names error messages.
|
|
Packit |
5ce601 |
- Make public the function to read a key file, dst_key_read_public().
|
|
Packit |
5ce601 |
- dig now returns the byte count for axfr/ixfr.
|
|
Packit |
5ce601 |
- allow-update is now settable at the options / view level.
|
|
Packit |
5ce601 |
- named-checkconf now checks the logging configuration.
|
|
Packit |
5ce601 |
- host now can turn on memory debugging flags with '-m'.
|
|
Packit |
5ce601 |
- Don't send notify messages to self.
|
|
Packit |
5ce601 |
- Perform sanity checks on NS records which refer to 'in zone' names.
|
|
Packit |
5ce601 |
- New zone option "notify-delay". Specify a minimum delay between sets of
|
|
Packit |
5ce601 |
NOTIFY messages.
|
|
Packit |
5ce601 |
- Extend adjusting TTL warning messages.
|
|
Packit |
5ce601 |
- Named and named-checkzone can now both check for non-terminal wildcard
|
|
Packit |
5ce601 |
records.
|
|
Packit |
5ce601 |
- "rndc freeze/thaw" now freezes/thaws all zones.
|
|
Packit |
5ce601 |
- named-checkconf now check acls to verify that they only refer to existing
|
|
Packit |
5ce601 |
acls.
|
|
Packit |
5ce601 |
- The server syntax has been extended to support a range of servers.
|
|
Packit |
5ce601 |
- Report differences between hints and real NS rrset and associated address
|
|
Packit |
5ce601 |
records.
|
|
Packit |
5ce601 |
- Preserve the case of domain names in rdata during zone transfers.
|
|
Packit |
5ce601 |
- Restructured the data locking framework using architecture dependent
|
|
Packit |
5ce601 |
atomic operations (when available), improving response performance on
|
|
Packit |
5ce601 |
multi-processor machines significantly. x86, x86_64, alpha, powerpc, and
|
|
Packit |
5ce601 |
mips are currently supported.
|
|
Packit |
5ce601 |
- UNIX domain controls are now supported.
|
|
Packit |
5ce601 |
- Add support for additional zone file formats for improving loading
|
|
Packit |
5ce601 |
performance. The masterfile-format option in named.conf can be used to
|
|
Packit |
5ce601 |
specify a non-default format. A separate command named-compilezone was
|
|
Packit |
5ce601 |
provided to generate zone files in the new format. Additionally, the -I
|
|
Packit |
5ce601 |
and -O options for dnssec-signzone specify the input and output formats.
|
|
Packit |
5ce601 |
- dnssec-signzone can now randomize signature end times (dnssec-signzone -j
|
|
Packit |
5ce601 |
jitter).
|
|
Packit |
5ce601 |
- Add support for CH A record.
|
|
Packit |
5ce601 |
- Add additional zone data constancy checks. named-checkzone has extended
|
|
Packit |
5ce601 |
checking of NS, MX and SRV record and the hosts they reference. named
|
|
Packit |
5ce601 |
has extended post zone load checks. New zone options: check-mx and
|
|
Packit |
5ce601 |
integrity-check.
|
|
Packit |
5ce601 |
- edns-udp-size can now be overridden on a per server basis.
|
|
Packit |
5ce601 |
- dig can now specify the EDNS version when making a query.
|
|
Packit |
5ce601 |
- Added framework for handling multiple EDNS versions.
|
|
Packit |
5ce601 |
- Additional memory debugging support to track size and mctx arguments.
|
|
Packit |
5ce601 |
- Detect duplicates of UDP queries we are recursing on and drop them. New
|
|
Packit |
5ce601 |
stats category "duplicates".
|
|
Packit |
5ce601 |
- "USE INTERNAL MALLOC" is now runtime selectable.
|
|
Packit |
5ce601 |
- The lame cache is now done on a <qname,qclass,qtype> basis as some
|
|
Packit |
5ce601 |
servers only appear to be lame for certain query types.
|
|
Packit |
5ce601 |
- Limit the number of recursive clients that can be waiting for a single
|
|
Packit |
5ce601 |
query (<qname,qtype,qclass>) to resolve. New options clients-per-query
|
|
Packit |
5ce601 |
and max-clients-per-query.
|
|
Packit |
5ce601 |
- dig: report the number of extra bytes still left in the packet after
|
|
Packit |
5ce601 |
processing all the records.
|
|
Packit |
5ce601 |
- Support for IPSECKEY rdata type.
|
|
Packit |
5ce601 |
- Raise the UDP receive buffer size to 32k if it is less than 32k.
|
|
Packit |
5ce601 |
- x86 and x86_64 now have separate atomic locking implementations.
|
|
Packit |
5ce601 |
- named-checkconf now validates update-policy entries.
|
|
Packit |
5ce601 |
- Attempt to make the amount of work performed in a iteration self tuning.
|
|
Packit |
5ce601 |
The covers nodes clean from the cache per iteration, nodes written to
|
|
Packit |
5ce601 |
disk when rewriting a master file and nodes destroyed per iteration when
|
|
Packit |
5ce601 |
destroying a zone or a cache.
|
|
Packit |
5ce601 |
- ISC string copy API.
|
|
Packit |
5ce601 |
- Automatic empty zone creation for D.F.IP6.ARPA and friends. Note: RFC
|
|
Packit |
5ce601 |
1918 zones are not yet covered by this but are likely to be in a future
|
|
Packit |
5ce601 |
release.
|
|
Packit |
5ce601 |
- New options: empty-server, empty-contact, empty-zones-enable and
|
|
Packit |
5ce601 |
disable-empty-zone.
|
|
Packit |
5ce601 |
- dig now has a '-q queryname' and '+showsearch' options.
|
|
Packit |
5ce601 |
- host/nslookup now continue (default)/fail on SERVFAIL.
|
|
Packit |
5ce601 |
- dig now warns if 'RA' is not set in the answer when 'RD' was set in the
|
|
Packit |
5ce601 |
query. host/nslookup skip servers that fail to set 'RA' when 'RD' is set
|
|
Packit |
5ce601 |
unless a server is explicitly set.
|
|
Packit |
5ce601 |
- Integrate contributed DLZ code into named.
|
|
Packit |
5ce601 |
- Integrate contributed IDN code from JPNIC.
|
|
Packit |
5ce601 |
- libbind: corresponds to that from BIND 8.4.7.
|
|
Packit |
5ce601 |
|
|
Packit |
5ce601 |
#### BIND 9.3.0
|
|
Packit |
5ce601 |
|
|
Packit |
5ce601 |
- DNSSEC is now DS based (RFC 3658).
|
|
Packit |
5ce601 |
- DNSSEC lookaside validation.
|
|
Packit |
5ce601 |
- check-names is now implemented.
|
|
Packit |
5ce601 |
- rrset-order is more complete.
|
|
Packit |
5ce601 |
- IPv4/IPv6 transition support, dual-stack-servers.
|
|
Packit |
5ce601 |
- IXFR deltas can now be generated when loading master files,
|
|
Packit |
5ce601 |
ixfr-from-differences.
|
|
Packit |
5ce601 |
- It is now possible to specify the size of a journal, max-journal-size.
|
|
Packit |
5ce601 |
- It is now possible to define a named set of master servers to be used in
|
|
Packit |
5ce601 |
masters clause, masters.
|
|
Packit |
5ce601 |
- The advertised EDNS UDP size can now be set, edns-udp-size.
|
|
Packit |
5ce601 |
- allow-v6-synthesis has been obsoleted.
|
|
Packit |
5ce601 |
- Zones containing MD and MF will now be rejected.
|
|
Packit |
5ce601 |
- dig, nslookup name. now report "Not Implemented" as NOTIMP rather than
|
|
Packit |
5ce601 |
NOTIMPL. This will have impact on scripts that are looking for NOTIMPL.
|
|
Packit |
5ce601 |
- libbind: corresponds to that from BIND 8.4.5.
|
|
Packit |
5ce601 |
|
|
Packit |
5ce601 |
#### BIND 9.2.0
|
|
Packit |
5ce601 |
|
|
Packit |
5ce601 |
- The size of the cache can now be limited using the "max-cache-size"
|
|
Packit |
5ce601 |
option.
|
|
Packit |
5ce601 |
- The server can now automatically convert RFC1886-style recursive lookup
|
|
Packit |
5ce601 |
requests into RFC2874-style lookups, when enabled using the new option
|
|
Packit |
5ce601 |
"allow-v6-synthesis". This allows stub resolvers that support AAAA
|
|
Packit |
5ce601 |
records but not A6 record chains or binary labels to perform lookups in
|
|
Packit |
5ce601 |
domains that make use of these IPv6 DNS features.
|
|
Packit |
5ce601 |
- Performance has been improved.
|
|
Packit |
5ce601 |
- The man pages now use the more portable "man" macros rather than the
|
|
Packit |
5ce601 |
"mandoc" macros, and are installed by "make install".
|
|
Packit |
5ce601 |
- The named.conf parser has been completely rewritten. It now supports
|
|
Packit |
5ce601 |
"include" directives in more places such as inside "view" statements, and
|
|
Packit |
5ce601 |
it no longer has any reserved words.
|
|
Packit |
5ce601 |
- The "rndc status" command is now implemented.
|
|
Packit |
5ce601 |
- rndc can now be configured automatically.
|
|
Packit |
5ce601 |
- A BIND 8 compatible stub resolver library is now included in lib/bind.
|
|
Packit |
5ce601 |
- OpenSSL has been removed from the distribution. This means that to use
|
|
Packit |
5ce601 |
DNSSEC, OpenSSL must be installed and the --with-openssl option must be
|
|
Packit |
5ce601 |
supplied to configure. This does not apply to the use of TSIG, which
|
|
Packit |
5ce601 |
does not require OpenSSL.
|
|
Packit |
5ce601 |
- The source distribution now builds on Windows. See
|
|
Packit |
5ce601 |
win32utils/readme1.txt and win32utils/win32-build.txt for details.
|
|
Packit |
5ce601 |
- This distribution also includes a new lightweight stub resolver library
|
|
Packit |
5ce601 |
and associated resolver daemon that fully support forward and reverse
|
|
Packit |
5ce601 |
lookups of both IPv4 and IPv6 addresses. This library is considered
|
|
Packit |
5ce601 |
experimental and is not a complete replacement for the BIND 8 resolver
|
|
Packit |
5ce601 |
library. Applications that use the BIND 8 `res_*` functions to perform
|
|
Packit |
5ce601 |
DNS lookups or dynamic updates still need to be linked against the BIND 8
|
|
Packit |
5ce601 |
libraries. For DNS lookups, they can also use the new "getrrsetbyname()"
|
|
Packit |
5ce601 |
API.
|
|
Packit |
5ce601 |
- BIND 9.2 is capable of acting as an authoritative server for DNSSEC
|
|
Packit |
5ce601 |
secured zones. This functionality is believed to be stable and complete
|
|
Packit |
5ce601 |
except for lacking support for verifications involving wildcard records
|
|
Packit |
5ce601 |
in secure zones.
|
|
Packit |
5ce601 |
- When acting as a caching server, BIND 9.2 can be configured to perform
|
|
Packit |
5ce601 |
DNSSEC secure resolution on behalf of its clients. This part of the
|
|
Packit |
5ce601 |
DNSSEC implementation is still considered experimental. For detailed
|
|
Packit |
5ce601 |
information about the state of the DNSSEC implementation, see the file
|
|
Packit |
5ce601 |
doc/misc/dnssec.
|